7 |
8 |
9 |
12 | A simple web app to view GetContact profile or tag(s) directly via the API without needing to access the mobile app, written in PHP.
13 |
14 |
17 | View Demo
18 | ·
19 | Report Bug
20 | ·
21 | Request Feature
22 |
37 | 
38 | 
39 | 
40 |
88 | 3. Copy and paste both values into the configuration file: `src/configurations/getcontact.php`.
89 |
90 | ```php
91 | // just example
92 | define("GTC_CREDENTIALS", json_encode([
93 | [
94 | "account" => "FILL_THIS_WITH_SHORT_DESCRIPTION_ABOUT_YOUR_GTC_ACCOUNT",
95 | "finalKey" => "CHANGE_WITH_YOUR_FINAL_KEY",
96 | "token" => "CHANGE_WITH_YOUR_TOKEN",
97 | ],
98 | ]));
99 | ```
100 |
101 |
102 |
103 | ## How to get GetContact Final Key & Token (Automatic)
104 |
105 | You can use an external tool here: [https://tools.naufalist.com/getcontact/credentials/generate](https://tools.naufalist.com/getcontact/credentials/generate), or you can do this by yourself from `/dashboard/credentials/generate`.
106 |
107 | > :exclamation: Due to some limitations, the generate process from the web might sometimes fail because of rate limiting. Therefore, I recommend that you generate the credentials yourself using the feature already available on your local setup.
108 |
109 |
110 |
111 |
112 |
113 | ## Installation
114 |
115 | 1. Clone the repository. If you’re using XAMPP/Laragon/MAMP, place it in the htdocs directory.
116 |
117 | ```sh
118 | git clone https://github.com/naufalist/getcontact-web.git
119 | ```
120 | 2. In **src/configurations/getcontact.php**, you should update the credentials.
121 |
122 | > The number of credentials you can choose in the form depends on how many credential entries you’ve added.
123 | >
124 |
125 | ```php
126 | // just example
127 | define("GTC_CREDENTIALS", json_encode([
128 | [
129 | "account" => "Account #1",
130 | "finalKey" => "abc",
131 | "token" => "def",
132 | ],
133 | [
134 | "account" => "Account #2",
135 | "finalKey" => "ghi",
136 | "token" => "jkl",
137 | ],
138 | ]));
139 | ```
140 | 3. Start the web server
141 | 4. Now, this app can be accessed in `http://localhost/getcontact-web`.
142 |
143 |
144 |
145 |
146 |
147 | ## Usage (Search feature)
148 |
149 | 1. Access this site: `http://localhost/getcontact-web`.
150 | 2. Enter the phone number into the form, for example: `081234567890`.
151 | 3. Select the final key and token you want to use.
152 | 4. Select the type of search: whether you want to look up a profile or search for tags.
153 | 5. Click the submit button.
154 | 6. If success, information from GetContact will be displayed above the form.
155 | 7. Or, if it fails, the error message will appear in an alert and also above the form.
156 |
157 |
158 |
159 |
160 |
161 | ## Contributing
162 |
163 | If you have a suggestion that would make this better, please fork the repo and create a pull request. You can also simply open an issue with the tag "enhancement".
164 |
165 |
166 |
167 |
168 |
169 | ## License
170 |
171 | This repo is under [MIT License](https://opensource.org/licenses/mit-license.php)
172 |
173 |
174 |
175 |
176 |
177 | ## Contact
178 |
179 | [@naufalist](https://twitter.com/naufalist) - contact.naufalist@gmail.com
180 |
181 |
182 |
--------------------------------------------------------------------------------
/src/libraries/helper.php:
--------------------------------------------------------------------------------
1 | ";
7 | print_r($variable);
8 | echo "";
9 | }
10 | }
11 |
12 | if (!function_exists("dd")) {
13 | function dd($variable)
14 | {
15 | var_dump($variable);
16 | die();
17 | }
18 | }
19 |
20 | if (!function_exists("base_url")) {
21 | function base_url($suffix = "")
22 | {
23 | $protocol = isset($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] === "on" ? "https" : "http";
24 | $domain = $_SERVER["HTTP_HOST"];
25 | $base_url = $protocol . "://" . $domain . URL_PREFIX . "/" . ltrim($suffix, "/");
26 | return $base_url;
27 | }
28 | }
29 |
30 | if (!function_exists("page_file_exists")) {
31 | function page_file_exists(string $filePath)
32 | {
33 | if (!file_exists($filePath)) {
34 | header("HTTP/1.0 404 Not Found");
35 | exit();
36 | }
37 | }
38 | }
39 |
40 | if (!function_exists("is_logged_in")) {
41 | function is_logged_in()
42 | {
43 | $max_inactive = SESSION_MAX_INACTIVE ?? 3600;
44 |
45 | if (!isset($_SESSION["admin_id"])) {
46 | return false;
47 | }
48 |
49 | if (!isset($_SESSION["last_activity"])) {
50 | return false;
51 | }
52 |
53 | if (time() - $_SESSION["last_activity"] > $max_inactive) {
54 | session_unset();
55 | session_destroy();
56 | return false;
57 | }
58 |
59 | // auto slide expiry time
60 | $_SESSION["last_activity"] = time();
61 |
62 | return true;
63 | }
64 | }
65 |
66 | if (!function_exists("require_login")) {
67 | function require_login()
68 | {
69 | if (!is_logged_in()) {
70 | header("Location: " . URL_PREFIX . "/dashboard");
71 | exit();
72 | }
73 | }
74 | }
75 |
76 | if (!function_exists("csrf_token_generate")) {
77 | function csrf_token_generate()
78 | {
79 | if (empty($_SESSION["csrf_token"])) {
80 | $_SESSION["csrf_token"] = bin2hex(random_bytes(32));
81 | $_SESSION["csrf_token_expire"] = time() + CSRF_EXPIRY_DURATION;
82 | }
83 |
84 | return $_SESSION["csrf_token"];
85 | }
86 | }
87 |
88 | if (!function_exists("csrf_token_validate")) {
89 | function csrf_token_validate(string $csrfToken)
90 | {
91 | if (!isset($_SESSION["csrf_token"])) {
92 | return false;
93 | }
94 |
95 | if (!isset($_SESSION["csrf_token_expire"])) {
96 | return false;
97 | }
98 |
99 | if (!is_string($csrfToken)) {
100 | return false;
101 | }
102 |
103 | $is_csrf_token_valid = hash_equals($_SESSION["csrf_token"], $csrfToken);
104 |
105 | if (!$is_csrf_token_valid) {
106 | return false;
107 | }
108 |
109 | // auto renew
110 | if ($_SESSION["csrf_token_expire"] < time()) {
111 | unset($_SESSION["csrf_token"]);
112 | unset($_SESSION["csrf_token_expire"]);
113 | csrf_token_generate();
114 | }
115 |
116 | return true;
117 | }
118 | }
119 |
120 | if (!function_exists("curl_execute_request")) {
121 | function curl_execute_request($curl)
122 | {
123 | try {
124 | $response = curl_exec($curl);
125 | $header_size = curl_getinfo($curl, CURLINFO_HEADER_SIZE);
126 | $http_code = curl_getinfo($curl, CURLINFO_HTTP_CODE);
127 |
128 | $response_header = null;
129 | $response_body = null;
130 |
131 | if ($response !== false) {
132 | $response_header = substr($response, 0, $header_size);
133 | $response_body = substr($response, $header_size);
134 | }
135 |
136 | if ($response === false || curl_errno($curl)) {
137 | $error_message = curl_error($curl);
138 | error_log("cURL Error: $error_message");
139 | error_log("Status Code: $http_code");
140 | error_log("Header: " . ($response_header ?? "[null]"));
141 | error_log("Body: " . ($response_body ?? "[null]"));
142 | throw new Exception("cURL failed: $error_message");
143 | }
144 |
145 | return (object)[
146 | "httpCode" => $http_code,
147 | "header" => $response_header,
148 | "body" => $response_body
149 | ];
150 | } finally {
151 | curl_close($curl);
152 | }
153 | }
154 | }
155 |
156 | if (!function_exists("log_api_transaction")) {
157 | function log_api_transaction($request, $response, $label = "API")
158 | {
159 | error_log("==== [REQUEST ($label)] ====");
160 | error_log(json_encode($request, JSON_PRETTY_PRINT));
161 |
162 | error_log("==== [RESPONSE ($label)] ====");
163 | error_log(json_encode($response, JSON_PRETTY_PRINT));
164 |
165 | error_log("==========================");
166 | }
167 | }
168 |
169 | if (!function_exists("has_nested_property")) {
170 | function has_nested_property($data, $path)
171 | {
172 | $keys = explode(".", $path);
173 |
174 | foreach ($keys as $key) {
175 | if (is_object($data)) {
176 | if (!isset($data->$key)) {
177 | return false;
178 | }
179 | $data = $data->$key;
180 | } elseif (is_array($data)) {
181 | if (!array_key_exists($key, $data)) {
182 | return false;
183 | }
184 | $data = $data[$key];
185 | } else {
186 | return false;
187 | }
188 | }
189 |
190 | return true;
191 | }
192 | }
193 |
194 | if (!function_exists("get_nested_value")) {
195 |
196 | /**
197 | * Example of usage:
198 | *
199 | * $token = get_nested_value($data, "result.token");
200 | * echo "Token: " . ($token ?? "-") . PHP_EOL;
201 | *
202 | * $providers = get_nested_value($data, "result.preEmailValidate.providerList");
203 | * $first_provider = is_array($providers) && isset($providers[0]) ? $providers[0] : null;
204 | * echo "First Provider: " . ($first_provider ?? "-") . PHP_EOL;
205 | */
206 | function get_nested_value($data, $path, $default = null)
207 | {
208 | $keys = explode(".", $path);
209 |
210 | foreach ($keys as $key) {
211 | if (is_object($data)) {
212 | if (!isset($data->$key)) {
213 | return $default;
214 | }
215 | $data = $data->$key;
216 | } elseif (is_array($data)) {
217 | if (!array_key_exists($key, $data)) {
218 | return $default;
219 | }
220 | $data = $data[$key];
221 | } else {
222 | return $default;
223 | }
224 | }
225 |
226 | return $data;
227 | }
228 | }
229 |
230 | if (!function_exists("encrypt_data")) {
231 | function encrypt_data($input)
232 | {
233 | if (!is_string($input) && !is_int($input) && !is_array($input)) {
234 | return false;
235 | }
236 |
237 | $data = json_encode($input);
238 | if ($data === false) {
239 | return false;
240 | }
241 |
242 | $key = hash("sha256", FORM_SECRET_KEY, true);
243 |
244 | $iv = openssl_random_pseudo_bytes(16); // random IV, 16 byte, for AES-256-CBC
245 |
246 | $encrypted = openssl_encrypt($data, "AES-256-CBC", $key, OPENSSL_RAW_DATA, $iv);
247 | if ($encrypted === false) {
248 | return false;
249 | }
250 |
251 | $hmac = hash_hmac("sha256", $encrypted, $key, true); // hmac for integrity
252 |
253 | return base64_encode($iv . $hmac . $encrypted);
254 | }
255 | }
256 |
257 | if (!function_exists("decrypt_data")) {
258 | function decrypt_data($encryptedData)
259 | {
260 | $key = hash("sha256", FORM_SECRET_KEY, true);
261 |
262 | $decoded = base64_decode($encryptedData, true);
263 | if ($decoded === false || strlen($decoded) < 48) {
264 | return false; // 16 (IV) + 32 (HMAC)
265 | }
266 |
267 | // separate
268 | $iv = substr($decoded, 0, 16);
269 | $hmac = substr($decoded, 16, 32);
270 | $ciphertext = substr($decoded, 48);
271 |
272 | $calculated_hmac = hash_hmac("sha256", $ciphertext, $key, true);
273 | if (!hash_equals($hmac, $calculated_hmac)) {
274 | return false;
275 | }
276 |
277 | $decrypted = openssl_decrypt($ciphertext, "AES-256-CBC", $key, OPENSSL_RAW_DATA, $iv);
278 | if ($decrypted === false) return false;
279 |
280 | return json_decode($decrypted, true); // true: decode to array/primitive
281 | }
282 | }
283 |
284 | if (!function_exists("censor_phone_number")) {
285 | function censor_phone_number($phoneNumber)
286 | {
287 | if (strlen($phoneNumber) < 7) {
288 | return "xxxxx";
289 | }
290 |
291 | $censored_after_position = 6;
292 | $count_censored_digit = 5;
293 |
294 | return substr_replace($phoneNumber, "xxxxx", $censored_after_position, $count_censored_digit);
295 | }
296 | }
297 |
--------------------------------------------------------------------------------
/src/apis/subscription.php:
--------------------------------------------------------------------------------
1 | "Method not allowed"
19 | ]);
20 | exit();
21 | }
22 |
23 | #endregion
24 |
25 | #region Test
26 |
27 | // test
28 | // $result = [
29 | // "info" => [
30 | // "search" => [
31 | // "limit" => 999,
32 | // "remainingCount" => 999,
33 | // ],
34 | // "numberDetail" => [
35 | // "limit" => 999,
36 | // "remainingCount" => 999,
37 | // ],
38 | // "receiptEndDate" => ""
39 | // ]
40 | // ];
41 |
42 | // http_response_code(200);
43 | // echo json_encode([
44 | // "message" => "Data received successfully",
45 | // "data" => $result
46 | // ]);
47 | // exit();
48 | // test
49 |
50 | #endregion
51 |
52 | #region Parse request body
53 |
54 | $raw_json = file_get_contents("php://input");
55 |
56 | if (strlen($raw_json) > MAX_JSON_SIZE) {
57 | http_response_code(413);
58 | echo json_encode([
59 | "message" => "Payload too large"
60 | ]);
61 | exit();
62 | }
63 |
64 | $parsed_json = json_decode($raw_json, true);
65 |
66 | if (json_last_error() !== JSON_ERROR_NONE) {
67 | error_log(json_last_error_msg());
68 | error_log($raw_json);
69 | http_response_code(400);
70 | echo json_encode([
71 | "message" => "Invalid JSON response. Please check error log."
72 | ]);
73 | exit();
74 | }
75 |
76 | #endregion
77 |
78 | #region Parse and validate all request input
79 |
80 | $id = $parsed_json["id"] ?? null;
81 | $decrypted_id = decrypt_data($id);
82 | $decrypted_id = (int)$decrypted_id;
83 |
84 | if (!isset($decrypted_id) || !is_int($decrypted_id) || $decrypted_id <= 0) {
85 | error_log("Decryption failed for ID: $id");
86 | http_response_code(400);
87 | echo json_encode([
88 | "message" => "Invalid or malformed credential ID"
89 | ]);
90 | exit();
91 | }
92 |
93 | $id = $decrypted_id;
94 |
95 | #endregion
96 |
97 | #region Fetch and validate credentials from database/config
98 |
99 | if (USE_DATABASE) {
100 |
101 | $pdo_statement = $pdo->prepare("
102 | SELECT final_key AS finalKey, token AS token, client_device_id AS clientDeviceId
103 | FROM credentials
104 | WHERE deleted_at IS NULL AND id = ?
105 | ORDER BY id ASC
106 | ");
107 |
108 | $pdo_statement->execute([$id]);
109 |
110 | $credential = $pdo_statement->fetch(PDO::FETCH_ASSOC);
111 | } else {
112 | $credentials = json_decode(GTC_CREDENTIALS, true);
113 |
114 | if (json_last_error() !== JSON_ERROR_NONE) {
115 | error_log(json_last_error());
116 | http_response_code(400);
117 | echo json_encode([
118 | "message" => "Invalid credentials"
119 | ]);
120 | exit();
121 | }
122 |
123 | $credential = array_filter($credentials, function ($credential) use ($id) {
124 | return $credential["id"] === $id;
125 | });
126 |
127 | $credential = reset($credential);
128 | }
129 |
130 | if (!$credential || !isset($credential["finalKey"], $credential["token"])) {
131 | http_response_code(400);
132 | echo json_encode([
133 | "message" => "Credential not found or incomplete"
134 | ]);
135 | exit();
136 | }
137 |
138 | $final_key = $credential["finalKey"] ?? null;
139 | $token = $credential["token"] ?? null;
140 |
141 | if (empty($final_key) || empty($token)) {
142 | http_response_code(400);
143 | echo json_encode([
144 | "message" => "Invalid final key or token"
145 | ]);
146 | exit();
147 | }
148 |
149 | #endregion
150 |
151 | #region Call GetContact API Subscription
152 |
153 | $api_request = (object)[
154 | "clientDeviceId" => $credential["clientDeviceId"],
155 | "finalKey" => $final_key,
156 | "token" => $token
157 | ];
158 |
159 | $api_response = getcontact_call_api_subscription($api_request);
160 |
161 | #endregion
162 |
163 | #region Validate http status code
164 |
165 | if ($api_response->httpCode !== 200) {
166 | log_api_transaction($api_request, $api_response, "subscription: call");
167 | http_response_code(400);
168 | echo json_encode([
169 | "message" => "Invalid HTTP status code: " . $api_response->httpCode
170 | ]);
171 | exit();
172 | }
173 |
174 | #endregion
175 |
176 | #region Parse, decrypt, and decode API response
177 |
178 | $api_response_body = json_decode($api_response->body, false);
179 |
180 | if (json_last_error() !== JSON_ERROR_NONE) {
181 | log_api_transaction($api_request, $api_response, "subscription: decode body");
182 | error_log(json_last_error_msg());
183 | error_log($api_response->body);
184 | http_response_code(400);
185 | echo json_encode([
186 | "message" => "Invalid JSON response. Please check error log."
187 | ]);
188 | exit();
189 | }
190 |
191 | $decrypted_data_raw = getcontact_decrypt($api_response_body->data, $final_key);
192 | $decrypted_body = json_decode($decrypted_data_raw, false);
193 |
194 | if (json_last_error() !== JSON_ERROR_NONE) {
195 | log_api_transaction($api_request, $api_response, "subscription: decode body data");
196 | error_log(json_last_error_msg());
197 | error_log($decrypted_data_raw);
198 | http_response_code(400);
199 | echo json_encode([
200 | "message" => "Invalid JSON response. Please check error log."
201 | ]);
202 | exit();
203 | }
204 |
205 | if ($decrypted_body == null) {
206 | log_api_transaction($api_request, $api_response, "subscription: body null");
207 | http_response_code(500);
208 | echo json_encode([
209 | "message" => "Could not get subscription info (invalid response body)"
210 | ]);
211 | exit();
212 | }
213 |
214 | #endregion
215 |
216 | #region Validate and return result
217 |
218 | $search_limit_path = "result.subscriptionInfo.usage.search.limit";
219 | $search_remaining_count_path = "result.subscriptionInfo.usage.search.remainingCount";
220 | $number_detail_limit_path = "result.subscriptionInfo.usage.numberDetail.limit";
221 | $number_detail_remaining_count_path = "result.subscriptionInfo.usage.numberDetail.remainingCount";
222 | // $receipt_end_date_path = "result.subscriptionInfo.receiptEndDate";
223 | $renew_date_path = "result.subscriptionInfo.renewDate";
224 |
225 | $required_keys = [
226 | $search_limit_path,
227 | $search_remaining_count_path,
228 | $number_detail_limit_path,
229 | $number_detail_remaining_count_path,
230 | // $receipt_end_date_path,
231 | $renew_date_path,
232 | ];
233 |
234 | foreach ($required_keys as $path) {
235 | if (!has_nested_property($decrypted_body, $path)) {
236 | log_api_transaction($api_request, $api_response, "subscription: missing $path");
237 | http_response_code(500);
238 | echo json_encode([
239 | "message" => "Unexpected API response structure"
240 | ]);
241 | exit();
242 | }
243 | }
244 |
245 | $result = [
246 | "info" => [
247 | "search" => [
248 | "limit" => 0,
249 | "remainingCount" => 0,
250 | ],
251 | "numberDetail" => [
252 | "limit" => 0,
253 | "remainingCount" => 0,
254 | ],
255 | "receiptEndDate" => ""
256 | ]
257 | ];
258 |
259 | $result["info"]["search"]["limit"] = get_nested_value($decrypted_body, $search_limit_path);
260 | $result["info"]["search"]["remainingCount"] = get_nested_value($decrypted_body, $search_remaining_count_path);
261 | $result["info"]["numberDetail"]["limit"] = get_nested_value($decrypted_body, $number_detail_limit_path);
262 | $result["info"]["numberDetail"]["remainingCount"] = get_nested_value($decrypted_body, $number_detail_remaining_count_path);
263 | // $result["info"]["receiptEndDate"] = get_nested_value($decrypted_body, $receipt_end_date_path);
264 | $result["info"]["receiptEndDate"] = get_nested_value($decrypted_body, $renew_date_path);
265 |
266 | http_response_code(200);
267 | echo json_encode([
268 | "message" => "Data received successfully",
269 | "data" => $result
270 | ]);
271 | exit();
272 |
273 | #endregion
274 |
275 | } catch (\Exception $e) {
276 | error_log("Error GetContact API Subscription: " . $e->getMessage());
277 | http_response_code(500);
278 | echo json_encode([
279 | "message" => "Internal server error"
280 | ]);
281 | exit();
282 | }
283 |
--------------------------------------------------------------------------------
/src/pages/dashboard/login.php:
--------------------------------------------------------------------------------
1 | prepare("SELECT id, username, password FROM administrators WHERE username = :username");
58 | $pdo_statement->execute(["username" => $username]);
59 | $admin = $pdo_statement->fetch();
60 |
61 | if (!$admin || !password_verify($password, $admin["password"])) {
62 | $error = "Username or password is invalid";
63 | break;
64 | }
65 |
66 | $_SESSION["admin_id"] = $admin["id"];
67 | $_SESSION["last_activity"] = time();
68 | header("Location: " . URL_PREFIX . "/dashboard/credentials/manage");
69 | exit();
70 |
71 | #endregion
72 |
73 | break;
74 | }
75 |
76 | $csrf_token = csrf_token_generate();
77 |
78 | ?>
79 |
80 |
81 |
82 |
83 |
84 |
85 |
86 |
87 | | ID | 248 |Description | 249 |Credential Data | 250 |Header Data | 251 |Created At/Updated At | 252 |Action | 253 |
|---|---|---|---|---|---|
| 259 | | 260 | |
261 |
|
268 |
269 |
|
274 |
275 | admin 276 | admin 277 | |
278 | 279 | 280 | &updated_at=" onclick="return confirm('Yakin ingin hapus data ini?')" class="btn btn-danger btn-sm">Delete 281 | | 282 |
| ');g.push(" |